chore(deps): update aiohttp, multidict, PyJWT, and required yarl security floors

pyproject.toml

@@ -41,7 +41,9 @@ Repository = "https://github.com/openai/openai-python"
 
 [project.optional-dependencies]
 aiohttp = [
-  "aiohttp>=3.14.3",
+  "aiohttp>=3.14.4",
+  "multidict>=6.9.1",
+  "yarl>=1.25.1",
 ]
 realtime = ["websockets >= 13, < 16"]
 datalib = ["numpy >= 1", "pandas >= 1.2.3"]
@@ -101,7 +103,7 @@ constraint-dependencies = [
     "cryptography>=50.0.0",
     "msal>=1.37.0",
     "pygments>=2.20.0",
-    "pyjwt>=2.14.0",
+    "pyjwt>=2.15.0",
     "requests>=2.33.0",
 ]
 # Also constrain editable/source builds performed by uv sync.

scripts/check-python-version-policy.py

@@ -9,7 +9,7 @@
 CURRENT_STABLE = SUPPORTED[-1]
 PRERELEASE = "3.15"
 UNMARKED_DEPENDENCIES = (
-    "aiohttp>=3.14.3",
+    "aiohttp>=3.14.4",
     "httpx2>=2.12.0, <3",
     "anyio>=4.10.0, <5",
     "botocore>=1.40.0,<2",

scripts/utils/validate-httpx2-wheel.py

@@ -54,8 +54,9 @@ def validate_metadata(wheel: Path) -> None:
         raise RuntimeError(f"The aiohttp extra must not install the legacy adapter package: {requirements}")
     if {"httpx", "httpx2"} & extras:
         raise RuntimeError(f"HTTP client selection must not require or expose an SDK extra: {extras}")
-    if not any(value.startswith("aiohttp>=3.14.3") for value in aiohttp):
-        raise RuntimeError(f"Expected the aiohttp extra to require a patched aiohttp release: {aiohttp}")
+    for expected in ("aiohttp>=3.14.4", "multidict>=6.9.1", "yarl>=1.25.1"):
+        if not any(value.startswith(expected + ";") for value in aiohttp):
+            raise RuntimeError(f"Expected the aiohttp extra to require {expected}: {aiohttp}")
 
 
 def run_case(

tests/test_dependency_constraints.py

@@ -9,7 +9,9 @@
 @pytest.mark.parametrize(
     ("name", "extra", "affected", "patched"),
     [
-        ("aiohttp", "aiohttp", "3.14.2", "3.14.3"),
+        ("aiohttp", "aiohttp", "3.14.3", "3.14.4"),
+        ("multidict", "aiohttp", "6.7.1", "6.9.1"),
+        ("yarl", "aiohttp", "1.24.2", "1.25.1"),
         ("urllib3", "bedrock", "2.6.3", "2.7.0"),
     ],
 )

tests/test_httpx2_base.py

@@ -7,6 +7,7 @@
 import subprocess
 import importlib.util
 from http.server import ThreadingHTTPServer, BaseHTTPRequestHandler
+from urllib.parse import urlsplit, parse_qsl
 from typing_extensions import override
 
 import httpx2
@@ -66,8 +67,11 @@ def handler(request: httpx2.Request) -> httpx2.Response:
 
 @pytest.mark.skipif(importlib.util.find_spec("aiohttp") is None, reason="the aiohttp extra is not installed")
 async def test_default_aiohttp_client_uses_httpx2() -> None:
+    paths: list[str] = []
+
     class ModelsHandler(BaseHTTPRequestHandler):
         def do_GET(self) -> None:
+            paths.append(self.path)
             self.send_response(200)
             self.send_header("Content-Type", "application/json")
             self.end_headers()
@@ -84,14 +88,24 @@ def log_message(self, format: str, *_args: object) -> None:  # noqa: A002
         async with AsyncOpenAI(
             api_key="test",
             base_url=f"http://127.0.0.1:{server.server_port}/v1",
-            http_client=openai.DefaultAioHttpClient(),
+            http_client=openai.DefaultAioHttpClient(trust_env=False),
             max_retries=0,
         ) as client:
             assert isinstance(client._client, httpx2.AsyncClient)
-            response = await client.models.with_raw_response.list()
+            response = await client.models.with_raw_response.list(
+                extra_query={"tag": ["first", "second"], "literal": "a+b & café %2F", "empty": ""}
+            )
     finally:
         await asyncio.to_thread(server.shutdown)
         thread.join()
         server.server_close()
 
     assert isinstance(response.http_response, httpx2.Response)
+
+    assert len(paths) == 1
+    assert parse_qsl(urlsplit(paths[0]).query, keep_blank_values=True) == [
+        ("tag[]", "first"),
+        ("tag[]", "second"),
+        ("literal", "a+b & café %2F"),
+        ("empty", ""),
+    ]